The rapid growth and widespread use of the Internet has brought with it an increased threat of hacker attacks on systems and/or networks coupled to the Internet, such as Local Area Networks (LANs). Such attacks may compromise sensitive information and/or destroy data. As a result, a number of companies such as Axent (Rockville, Md.), Internet Security Systems (Atlanta, Ga.), and Network Flight Recorder (Rockville, Md.) have developed Intrusion Detection Systems (IDS). An IDS is designed to analyze all received data for all potential security threats.
A hacker may compromise a LAN by gaining access to and controlling a host computer within the network. This process may involve the issuance of specific instructions to the host computer, which instructions are characterized by particular string of data bits, data sequences, or strings of characters or values.
A typical IDS attempts to detect hacker intrusions by monitoring or scanning all data strings contained in network traffic. A key capability of the typical IDS involves filtering network data packets for the purpose of identifying data packets exhibiting characteristics of known hacker attacks. Filtering typically comprises two tasks. First, identifying specific values in various fields of a protocol header. This is referred to as header filtering. Second, identifying character strings within a payload portion of the data packet. This is referred to as string filtering.
Hackers may communicate with host computers using services such as FTP, SUN Remote Procedure Call, Finger, and others. These services are typically transported over the Internet using TCP/IP protocols. Hackers attempt to exploit certain behaviors of the TCP and IP protocols to hide malicious strings. In particular, a hacker may define TCP/IP packet boundaries such that they bisect malicious strings. As a result, a simple IDS looking at individual data packets fails to recognize a complete string and the attack goes undetected.
To avoid this problem, a typical IDS performs TCP reassembly operations prior to scanning for strings. TCP reassembly operations are directed toward reconstructing an original service message as it appeared before it was divided into data packets for transmission in a specific protocol. A TCP reassembly process extracts service data from each TCP/IP packet, and pieces together the data contained in the payload of each TCP/IP packet to form a seamless data stream.
Packets may, however, arrive out of order, making TCP reassembly operations more difficult. Pointers within a TCP header may be used to re-order the data, but data must be temporarily stored until all of the “holes” in the data are filled. For example, the first of ten packets may arrive last and nine packets must be stored until the first packet hole is filled. This undesirably increases the time interval that an IDS must wait before scanning for strings associated with hacker attacks.
Furthermore, sufficient buffer space must be allocated to the TCP reassembly process to allow for worst-case storage needs. For example, storage of 10 packets with an average length of 1,500 bytes requires a minimum buffer size of 15,000 bytes. Similarly, the total buffer allocation required to support 10,000 simultaneous TCP connections would be 150,000,000 bytes. Buffer allocation places a practical limit on the number of simultaneous TCP connections that can be processed. Consequently, a more efficient method of TCP reassembly is needed to facilitate IDS deployment at high speed Internet access points, where 50,000 or more simultaneous connections are common.